| /* |
| * Copyright (c) 2003, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package sun.security.rsa; |
| |
| import java.math.BigInteger; |
| import java.util.*; |
| |
| import java.security.*; |
| import java.security.interfaces.*; |
| import java.security.spec.*; |
| |
| import javax.crypto.BadPaddingException; |
| import javax.crypto.spec.PSource; |
| import javax.crypto.spec.OAEPParameterSpec; |
| |
| import sun.security.jca.JCAUtil; |
| |
| /** |
| * RSA padding and unpadding. |
| * |
| * Format of PKCS#1 v1.5 padding is: |
| * 0x00 | BT | PS...PS | 0x00 | data...data |
| * where BT is the blocktype (1 or 2). The length of the entire string |
| * must be the same as the size of the modulus (i.e. 128 byte for a 1024 bit |
| * key). Per spec, the padding string must be at least 8 bytes long. That |
| * leaves up to (length of key in bytes) - 11 bytes for the data. |
| * |
| * OAEP padding is a bit more complicated and has a number of options. |
| * We support: |
| * . arbitrary hash functions ('Hash' in the specification), MessageDigest |
| * implementation must be available |
| * . MGF1 as the mask generation function |
| * . the empty string as the default value for label L and whatever |
| * specified in javax.crypto.spec.OAEPParameterSpec |
| * |
| * Note: RSA keys should be at least 512 bits long |
| * |
| * @since 1.5 |
| * @author Andreas Sterbenz |
| */ |
| public final class RSAPadding { |
| |
| // NOTE: the constants below are embedded in the JCE RSACipher class |
| // file. Do not change without coordinating the update |
| |
| // PKCS#1 v1.5 padding, blocktype 1 (signing) |
| public final static int PAD_BLOCKTYPE_1 = 1; |
| // PKCS#1 v1.5 padding, blocktype 2 (encryption) |
| public final static int PAD_BLOCKTYPE_2 = 2; |
| // nopadding. Does not do anything, but allows simpler RSACipher code |
| public final static int PAD_NONE = 3; |
| // PKCS#1 v2.1 OAEP padding |
| public final static int PAD_OAEP_MGF1 = 4; |
| |
| // type, one of PAD_* |
| private final int type; |
| |
| // size of the padded block (i.e. size of the modulus) |
| private final int paddedSize; |
| |
| // PRNG used to generate padding bytes (PAD_BLOCKTYPE_2, PAD_OAEP_MGF1) |
| private SecureRandom random; |
| |
| // maximum size of the data |
| private final int maxDataSize; |
| |
| // OAEP: main messagedigest |
| private MessageDigest md; |
| |
| // OAEP: message digest for MGF1 |
| private MessageDigest mgfMd; |
| |
| // OAEP: value of digest of data (user-supplied or zero-length) using md |
| private byte[] lHash; |
| |
| /** |
| * Get a RSAPadding instance of the specified type. |
| * Keys used with this padding must be paddedSize bytes long. |
| */ |
| public static RSAPadding getInstance(int type, int paddedSize) |
| throws InvalidKeyException, InvalidAlgorithmParameterException { |
| return new RSAPadding(type, paddedSize, null, null); |
| } |
| |
| /** |
| * Get a RSAPadding instance of the specified type. |
| * Keys used with this padding must be paddedSize bytes long. |
| */ |
| public static RSAPadding getInstance(int type, int paddedSize, |
| SecureRandom random) throws InvalidKeyException, |
| InvalidAlgorithmParameterException { |
| return new RSAPadding(type, paddedSize, random, null); |
| } |
| |
| /** |
| * Get a RSAPadding instance of the specified type, which must be |
| * OAEP. Keys used with this padding must be paddedSize bytes long. |
| */ |
| public static RSAPadding getInstance(int type, int paddedSize, |
| SecureRandom random, OAEPParameterSpec spec) |
| throws InvalidKeyException, InvalidAlgorithmParameterException { |
| return new RSAPadding(type, paddedSize, random, spec); |
| } |
| |
| // internal constructor |
| private RSAPadding(int type, int paddedSize, SecureRandom random, |
| OAEPParameterSpec spec) throws InvalidKeyException, |
| InvalidAlgorithmParameterException { |
| this.type = type; |
| this.paddedSize = paddedSize; |
| this.random = random; |
| if (paddedSize < 64) { |
| // sanity check, already verified in RSASignature/RSACipher |
| throw new InvalidKeyException("Padded size must be at least 64"); |
| } |
| switch (type) { |
| case PAD_BLOCKTYPE_1: |
| case PAD_BLOCKTYPE_2: |
| maxDataSize = paddedSize - 11; |
| break; |
| case PAD_NONE: |
| maxDataSize = paddedSize; |
| break; |
| case PAD_OAEP_MGF1: |
| String mdName = "SHA-1"; |
| String mgfMdName = "SHA-1"; |
| byte[] digestInput = null; |
| try { |
| if (spec != null) { |
| mdName = spec.getDigestAlgorithm(); |
| String mgfName = spec.getMGFAlgorithm(); |
| if (!mgfName.equalsIgnoreCase("MGF1")) { |
| throw new InvalidAlgorithmParameterException |
| ("Unsupported MGF algo: " + mgfName); |
| } |
| mgfMdName = ((MGF1ParameterSpec)spec.getMGFParameters()).getDigestAlgorithm(); |
| PSource pSrc = spec.getPSource(); |
| String pSrcAlgo = pSrc.getAlgorithm(); |
| if (!pSrcAlgo.equalsIgnoreCase("PSpecified")) { |
| throw new InvalidAlgorithmParameterException |
| ("Unsupported pSource algo: " + pSrcAlgo); |
| } |
| digestInput = ((PSource.PSpecified) pSrc).getValue(); |
| } |
| md = MessageDigest.getInstance(mdName); |
| mgfMd = MessageDigest.getInstance(mgfMdName); |
| } catch (NoSuchAlgorithmException e) { |
| throw new InvalidKeyException |
| ("Digest " + mdName + " not available", e); |
| } |
| lHash = getInitialHash(md, digestInput); |
| int digestLen = lHash.length; |
| maxDataSize = paddedSize - 2 - 2 * digestLen; |
| if (maxDataSize <= 0) { |
| throw new InvalidKeyException |
| ("Key is too short for encryption using OAEPPadding" + |
| " with " + mdName + " and MGF1" + mgfMdName); |
| } |
| break; |
| default: |
| throw new InvalidKeyException("Invalid padding: " + type); |
| } |
| } |
| |
| // cache of hashes of zero length data |
| private static final Map<String,byte[]> emptyHashes = |
| Collections.synchronizedMap(new HashMap<String,byte[]>()); |
| |
| /** |
| * Return the value of the digest using the specified message digest |
| * <code>md</code> and the digest input <code>digestInput</code>. |
| * if <code>digestInput</code> is null or 0-length, zero length |
| * is used to generate the initial digest. |
| * Note: the md object must be in reset state |
| */ |
| private static byte[] getInitialHash(MessageDigest md, |
| byte[] digestInput) { |
| byte[] result = null; |
| if ((digestInput == null) || (digestInput.length == 0)) { |
| String digestName = md.getAlgorithm(); |
| result = emptyHashes.get(digestName); |
| if (result == null) { |
| result = md.digest(); |
| emptyHashes.put(digestName, result); |
| } |
| } else { |
| result = md.digest(digestInput); |
| } |
| return result; |
| } |
| |
| /** |
| * Return the maximum size of the plaintext data that can be processed using |
| * this object. |
| */ |
| public int getMaxDataSize() { |
| return maxDataSize; |
| } |
| |
| /** |
| * Pad the data and return the padded block. |
| */ |
| public byte[] pad(byte[] data, int ofs, int len) |
| throws BadPaddingException { |
| return pad(RSACore.convert(data, ofs, len)); |
| } |
| |
| /** |
| * Pad the data and return the padded block. |
| */ |
| public byte[] pad(byte[] data) throws BadPaddingException { |
| if (data.length > maxDataSize) { |
| throw new BadPaddingException("Data must be shorter than " |
| + (maxDataSize + 1) + " bytes"); |
| } |
| switch (type) { |
| case PAD_NONE: |
| return data; |
| case PAD_BLOCKTYPE_1: |
| case PAD_BLOCKTYPE_2: |
| return padV15(data); |
| case PAD_OAEP_MGF1: |
| return padOAEP(data); |
| default: |
| throw new AssertionError(); |
| } |
| } |
| |
| /** |
| * Unpad the padded block and return the data. |
| */ |
| public byte[] unpad(byte[] padded, int ofs, int len) |
| throws BadPaddingException { |
| return unpad(RSACore.convert(padded, ofs, len)); |
| } |
| |
| /** |
| * Unpad the padded block and return the data. |
| */ |
| public byte[] unpad(byte[] padded) throws BadPaddingException { |
| if (padded.length != paddedSize) { |
| throw new BadPaddingException("Padded length must be " + paddedSize); |
| } |
| switch (type) { |
| case PAD_NONE: |
| return padded; |
| case PAD_BLOCKTYPE_1: |
| case PAD_BLOCKTYPE_2: |
| return unpadV15(padded); |
| case PAD_OAEP_MGF1: |
| return unpadOAEP(padded); |
| default: |
| throw new AssertionError(); |
| } |
| } |
| |
| /** |
| * PKCS#1 v1.5 padding (blocktype 1 and 2). |
| */ |
| private byte[] padV15(byte[] data) throws BadPaddingException { |
| byte[] padded = new byte[paddedSize]; |
| System.arraycopy(data, 0, padded, paddedSize - data.length, data.length); |
| int psSize = paddedSize - 3 - data.length; |
| int k = 0; |
| padded[k++] = 0; |
| padded[k++] = (byte)type; |
| if (type == PAD_BLOCKTYPE_1) { |
| // blocktype 1: all padding bytes are 0xff |
| while (psSize-- > 0) { |
| padded[k++] = (byte)0xff; |
| } |
| } else { |
| // blocktype 2: padding bytes are random non-zero bytes |
| if (random == null) { |
| random = JCAUtil.getSecureRandom(); |
| } |
| // generate non-zero padding bytes |
| // use a buffer to reduce calls to SecureRandom |
| byte[] r = new byte[64]; |
| int i = -1; |
| while (psSize-- > 0) { |
| int b; |
| do { |
| if (i < 0) { |
| random.nextBytes(r); |
| i = r.length - 1; |
| } |
| b = r[i--] & 0xff; |
| } while (b == 0); |
| padded[k++] = (byte)b; |
| } |
| } |
| return padded; |
| } |
| |
| /** |
| * PKCS#1 v1.5 unpadding (blocktype 1 and 2). |
| */ |
| private byte[] unpadV15(byte[] padded) throws BadPaddingException { |
| int k = 0; |
| if (padded[k++] != 0) { |
| throw new BadPaddingException("Data must start with zero"); |
| } |
| if (padded[k++] != type) { |
| throw new BadPaddingException("Blocktype mismatch: " + padded[1]); |
| } |
| while (true) { |
| int b = padded[k++] & 0xff; |
| if (b == 0) { |
| break; |
| } |
| if (k == padded.length) { |
| throw new BadPaddingException("Padding string not terminated"); |
| } |
| if ((type == PAD_BLOCKTYPE_1) && (b != 0xff)) { |
| throw new BadPaddingException("Padding byte not 0xff: " + b); |
| } |
| } |
| int n = padded.length - k; |
| if (n > maxDataSize) { |
| throw new BadPaddingException("Padding string too short"); |
| } |
| byte[] data = new byte[n]; |
| System.arraycopy(padded, padded.length - n, data, 0, n); |
| return data; |
| } |
| |
| /** |
| * PKCS#1 v2.0 OAEP padding (MGF1). |
| * Paragraph references refer to PKCS#1 v2.1 (June 14, 2002) |
| */ |
| private byte[] padOAEP(byte[] M) throws BadPaddingException { |
| if (random == null) { |
| random = JCAUtil.getSecureRandom(); |
| } |
| int hLen = lHash.length; |
| |
| // 2.d: generate a random octet string seed of length hLen |
| // if necessary |
| byte[] seed = new byte[hLen]; |
| random.nextBytes(seed); |
| |
| // buffer for encoded message EM |
| byte[] EM = new byte[paddedSize]; |
| |
| // start and length of seed (as index into EM) |
| int seedStart = 1; |
| int seedLen = hLen; |
| |
| // copy seed into EM |
| System.arraycopy(seed, 0, EM, seedStart, seedLen); |
| |
| // start and length of data block DB in EM |
| // we place it inside of EM to reduce copying |
| int dbStart = hLen + 1; |
| int dbLen = EM.length - dbStart; |
| |
| // start of message M in EM |
| int mStart = paddedSize - M.length; |
| |
| // build DB |
| // 2.b: Concatenate lHash, PS, a single octet with hexadecimal value |
| // 0x01, and the message M to form a data block DB of length |
| // k - hLen -1 octets as DB = lHash || PS || 0x01 || M |
| // (note that PS is all zeros) |
| System.arraycopy(lHash, 0, EM, dbStart, hLen); |
| EM[mStart - 1] = 1; |
| System.arraycopy(M, 0, EM, mStart, M.length); |
| |
| // produce maskedDB |
| mgf1(EM, seedStart, seedLen, EM, dbStart, dbLen); |
| |
| // produce maskSeed |
| mgf1(EM, dbStart, dbLen, EM, seedStart, seedLen); |
| |
| return EM; |
| } |
| |
| /** |
| * PKCS#1 v2.1 OAEP unpadding (MGF1). |
| */ |
| private byte[] unpadOAEP(byte[] padded) throws BadPaddingException { |
| byte[] EM = padded; |
| int hLen = lHash.length; |
| |
| if (EM[0] != 0) { |
| throw new BadPaddingException("Data must start with zero"); |
| } |
| |
| int seedStart = 1; |
| int seedLen = hLen; |
| |
| int dbStart = hLen + 1; |
| int dbLen = EM.length - dbStart; |
| |
| mgf1(EM, dbStart, dbLen, EM, seedStart, seedLen); |
| mgf1(EM, seedStart, seedLen, EM, dbStart, dbLen); |
| |
| // verify lHash == lHash' |
| for (int i = 0; i < hLen; i++) { |
| if (lHash[i] != EM[dbStart + i]) { |
| throw new BadPaddingException("lHash mismatch"); |
| } |
| } |
| |
| // skip over padding (0x00 bytes) |
| int i = dbStart + hLen; |
| while (EM[i] == 0) { |
| i++; |
| if (i >= EM.length) { |
| throw new BadPaddingException("Padding string not terminated"); |
| } |
| } |
| |
| if (EM[i++] != 1) { |
| throw new BadPaddingException |
| ("Padding string not terminated by 0x01 byte"); |
| } |
| |
| int mLen = EM.length - i; |
| byte[] m = new byte[mLen]; |
| System.arraycopy(EM, i, m, 0, mLen); |
| |
| return m; |
| } |
| |
| /** |
| * Compute MGF1 using mgfMD as the message digest. |
| * Note that we combine MGF1 with the XOR operation to reduce data |
| * copying. |
| * |
| * We generate maskLen bytes of MGF1 from the seed and XOR it into |
| * out[] starting at outOfs; |
| */ |
| private void mgf1(byte[] seed, int seedOfs, int seedLen, |
| byte[] out, int outOfs, int maskLen) throws BadPaddingException { |
| byte[] C = new byte[4]; // 32 bit counter |
| byte[] digest = new byte[20]; // 20 bytes is length of SHA-1 digest |
| while (maskLen > 0) { |
| mgfMd.update(seed, seedOfs, seedLen); |
| mgfMd.update(C); |
| try { |
| mgfMd.digest(digest, 0, digest.length); |
| } catch (DigestException e) { |
| // should never happen |
| throw new BadPaddingException(e.toString()); |
| } |
| for (int i = 0; (i < digest.length) && (maskLen > 0); maskLen--) { |
| out[outOfs++] ^= digest[i++]; |
| } |
| if (maskLen > 0) { |
| // increment counter |
| for (int i = C.length - 1; (++C[i] == 0) && (i > 0); i--) { |
| // empty |
| } |
| } |
| } |
| } |
| |
| } |
